To Jeena’s point about securing your oxygen mask before assisting others, let’s add Tracy Richelle High’s tips in the most recent ABA Journal: 10 ways to make time for the things that matter. The tips are fantastic. You should read them. In my view, Tracy nails it in her first paragraph:

“But the answer is quite simple: You make time for the things that matter. Period.”

As a profession, we talk a lot about access to justice & access to legal services. As I see it, lawyer well-being is an access issue. Access to legal services requires a full complement of healthy and competent lawyers.

Rules 1.1 and 1.6 impose a duty to act competently to safeguard against the inadvertent or unauthorized disclosure of information related to the representation of a client. I’ve blogged often on encryption, cloud storage, and other tech issues that impact the duty.

But I’ve also blogged that the most recent sanctions involving Rule 1.6 have nothing to do with hackers or technology. As I wrote:

“To wit: the last three sanctions for violations of Rule 1.6 in Vermont were imposed:

My guess is that far more lawyers have put information related to a representation at risk by leaving files or computers in restaurants or airport waiting areas than by sending unencrypted emails or storing information in the cloud.”

The lesson: don’t forget about the “simple” steps you can take to safeguard against the inadvertent disclosure of client information.

Today’s question is whether disabling your e-mail account’s “autocomplete” function is one of those steps.

The question arises from the evolving saga of one of the country’s more prestigious law firm’s inadvertent disclosure to the Wall Street Journal of confidential & privileged information. The matter involves Pepsi, an SEC investigation, and a Russian dairy company named Wimm-Bill-Dann. Above the Law’s Joe Patrice has the story here.

(As an aside, I wonder if the All-England Tennis Club has sued Wimm-Bill-Dan to change its name? Or, perhaps, the company is the official dairy product provider for The Championships.)

Back to the story.

Patrice suggests that an e-mail snafu may have caused the inadvertent disclosure :

“The memo, discussing a subpoena Smith received, was sent to the Wall Street Journal in an email including a number of other attorneys working on the matter. Given the circumstances, it’s safe to say someone’s inline autocomplete got the better of them. For any attorneys using a mailbox with that feature… maybe turn it off. On the plus side, as an efficiency aid, it saves you a few seconds every day. On the downside, one day it’ll send privileged and potentially career-ending documents to the press. Weigh those out and do whatever you think is best. Don’t worry, you can continue this story after you go into your mail preferences.”

Very interesting point.

The duty to act competently to safeguard client information includes a duty to take reasonable precautions against inadvertent disclosure. Is disabling autocomplete a reasonable precaution? Stated differently, is it unreasonable not to disable it?

I don’t know. But, I do know this.

My name is Michael Kennedy and my e-mail address is michael.kennedy@vermont.gov. Many of you know Judge Michael Kainen. Prior to being appointed to the bench, Judge Kainen was the Windsor County State’s Attorney. I don’t remember whether it happened when Judge Kainen was a prosecutor or after he’d been appointed. However, once, a lawyer who intended to e-mail a confidential ethics inquiry to me accidentally sent it to Judge Kainen.

How?

Hint: state’s attorneys and judges also have “vermont.gov” e-mail addresses.

Anyhow, what to say about 88? Those who know me best would be very disappointed if I said anything other than what I’m about to.

In February, I was in Miami for the annual meeting of the National Organization of Bar Counsel. The meeting ended on the day before the Super Bowl. Once it ended, I rented a car and drove to Key West.

The Keys perfectly suit my No Shoes Nation lifestyle. And, Key West is where my buddy Daren lives. We met in about 3rd grade. Now, Daren splits time between South Burlington & Key West. He and his girlfriend let me crash for the weekend.

Daren owns the Viva Saloon, official southern-most bar of Ethical Grounds. That’s where I watched the Super Bowl.

The manner in which the Falcons blew game remains unbelievable. Even more unbelivable? Look who stopped into Viva after the game and sat down next to me.

That’s my 88 story. Bonus points in the quiz to anyone who can tell me what, specifically, it’s got to do with 88.

Oh, and since I constantly harangue you about competence, and since I’m a basketball guy, and since we’re in Week 88, and since it’s September 29 . . . happy birthday Kevin Durant! KD was born on September 29, 1988. In my opinion, he’s the most competent player in the world today. Plus, thanks to this sequence, Kyrie is a Celtic!

Finally, to my readers who think I don’t mention Prince enough, it was on September 29 that Let’s Go Crazyreached #1 on the Billboad charts. Alas, 1984, not 1988.

Onto the quiz!

Rules

None. Open book, open search engine, text-a-friend.

Exception: Question 5. We try to play that one honest.

Unless stated otherwise, the Vermont Rules of Professional Conduct apply

Team entries welcome, creative team names even more welcome.

E-mail answers to michael.kennedy@vermont.gov

I’ll post the answers & Honor Roll on Monday

Please don’t use the “comment” feature to post your answers

Please consider sharing the quiz with friends & colleagues

Share on social media. Hashtag it – #fiveforfriday

Question 1

Prospective Client consults in good faith with Lawyer, with an eye towards retaining Lawyer. However, Client chooses not to retain Lawyer. Client notifies Lawyer of the decision.

Per the rules, Lawyer continues to owe Prospective Client a _____________, but in somewhat relaxed fashion as compared to a former client.

A. Duty of Loyalty

B. Duty to Maintain Client’s Confidences

C. Neither A nor B

D. Both A & B

Question 2

Which must a lawyer keep for 6 years following the termination of a representation?

A. The file

B. Client confidences

C. Complete records of funds held in trust and other property

D. Electronic communications with the client

Question 3

Attorney called me with an inquiry. I listened, then said:

“Client hasn’t paid in 8 months? Assuming nothing crucial is imminent, my position is that you’re permitted to file the motion. Whether the court grants it is another question. The question will be whether there will be a material adverse effect on your client.”

When we first met Mike Ross, he hadn’t gone to college or law school, but was earning money by taking (and passing) the LSAT for others. Then, to earn money to pay for his grandmother’s medical care, Mike agreed to deliver marijuana for a friend. Somehow he managed not to be arrested in the ensuing sting and, almost impossibly, ended up with a job interview at a law firm.

He was hired. As a lawyer. Even though Harvey, the partner who interviewed him, knew that Mike had not taken the bar exam or been admitted to practice.

After several years in practice, Mike was charged criminally with fraud & the unauthorized practice of law. While the jury deliberated, Mike agreed to a plea offered by Anita, the U.S Attorney who was prosecuting him.

After serving a prison stint, Mike passed the bar, with only review by the Character & Fitness Committee standing between him and admission. Yikes! Guess who bribed her way onto the committee charged with reviewing his application??? Anita!! She did so not only to keep Mike out, but to try to prove her theory that Harvey (and others) had known all along that Mike wasn’t a lawyer!

Amazingly, Mike was admitted and spent the show’s most recent season as a duly licensed member of the New York State Bar.

Last week, and in honor of Constitution Day, I offered to sing Schoolhouse Rock’s “The Premble” at the upcoming VBA meeting if a lawyer or firm pledged at least $1,000 to kickstart the Vermont Bar Foundation’s Access to Justice Campaign. Here’s what I wrote:

Of course, if people are not able to access the legal services that they need to protect their rights, the Constitution might mean little to them. So, in honor of Constitution Day, if an attorney or firm donates $1,000 to the Vermont Bar Foundation’s Access to Justice Campaign by Friday, September 29, I’ll karaoke the Schoolhouse Rock! version of The Preamble at the VBA’s upcoming annual meeting.”

Well, what do you know?

Earlier today, a former member of the Vermont Bar Association’s Board of Managers who prefers to remain anonymous stepped up to the plate and made a pledge that met the threshhold! Other former Bar Managers have joined in, making the threshhold but a speck in the rear-view.

It is an honor to have followed in their individual and collective footsteps.

I don’t remember much about contract law other than it met at 3PM during my 1L year at GW Law. Anyhow, it doesn’t matter much what I remember because, as far as I’m concerned, we have ourselves a deal! I’ll be singing at the annual meeting.

Now, as some have already suggested, we’d raise a hell of lot more money by taking donations to have me stop singing. I take no umbrage at the suggestion. My mom and her entire family have carried congregations with their voices for years. My dad and my brother have those silky smooth Irish voices. Me? Umm, my singing voice has been called many things, with “silky & smooth” not one of them.

(For someone who blogs so often about Rule 1.1 and the duty of competence, I’m fairly certain the prosecutors at the Department of Music Ethics will have me up on their equivalent of 1.1 in a heartbeat.)

So what does this mean? It means you’ll have to help ease the audible assault (and throw the music ethics investigators off my scent) by singing along! And the only way to do so is to learn the tune & the words yourself. The video is here. Practice makes perfect!

And, again, to those who made this happen, you’re awesome. You already were, but this just proves it yet again. Thank you.

P.S. – if you can’t make it, I’m sure Jennifer will have it on Facebook Live and we’ll find someone with Periscope.

Despite what I seem to blog about most, there’s more to trust account management than worrying about scams. Much more. And, being that it’s Thursday, I thought I’d harken back to a blog I posted in April 2015.

But first, the back story.

I pay my mortgage by phone. During each of my monthly calls, the very kind robot tells me that “our records indicate that you last made payment using account number xxxxxx.” Then, the robot asks me if I’d like to use the same account. I always press 1 for “yes.”

Which gets me to the point of this post.

I don’t know how often it happens, but I suspect that it is not uncommon for a client to ask a lawyer to use funds in trust to pay a client’s credit card bill. Assuming the lawyer is holding sufficient funds from the client to cover the payment, nothing in the rules prohibits the lawyer from acceding to the request.

Exercise caution when choosing to pay a client’s creditors. It is probably a very bad idea to pay in the same manner that I pay my mortgage. And, as this case proves, well-intentioned deeds do not necessarily go unsactioned.

Any act that provides a third-party with access to a client trust account is serious problem.

Here’s the rub: imagine you disburse from trust to the creditor. Imagine further that, like the bank that holds my mortgage, the client’s creditor links your trust account number to the client’s debt. Finally, imagine that the next time client calls in to make a payment, the very kind robot tells client “our records indicate that you last made payment using account number xxxxx . . . would you like to use the same account again? Press 1 for ‘yes’ ?”

I don’t know about you, but when I pay my mortgage by phone I press “1” for “yes” as soon as the robot starts to ask the question, without even waiting to hear the account number that’s on file. A client who does the same might unwittingly cause payment to be made from the lawyer’s trust account. Funds belonging to other clients might be used to cover the transaction. That’s a violation of Rule 1.15(f)(2).

Some readers asked what the perpetrators of a phishing scam hope to gain by targeting lawyers and law firms.

Access to information. Either yours or your clients’.

For example, be wary of an unsolicited e-mail that asks you to click on a link and confirm an account number or password. This is obvious, correct? If you respond, what have you done? That’s right – you’ve given out an account number and its password.

Lately, there’s been a rash of well-publicized phishing scams designed to release malware or ransomware. In some instances, the malware provides the scammer with access to data – account numbers, passwords, secure client information. In other instances, ransomware encrypts an office’s data. And by “encrypts” I mean “prevents the office from accessing the data unless or until a ransom is paid.” Think I’m exaggerating?

The Providence Journal has this story about a firm that was locked out of its data for three months earlier this year. The firm paid a ransom, then paid another, lost $700,000 in billings, and is in litigation with its cybersecurity carrier. Oh yeah, and how about being in the news for having had confidential information breached? Probably not the marketing campaign most of us would choose.

Or, from the FindLaw blog: last year, a prosecutor’s office in Pennsylvania paid a ransom to release files that had been locked after an employee clicked on a link in an e-mail that the employee believed to be from another government agency. Sound familiar? It should – that was yesterday’s pseudo-scam: an invitation for lawyers to click on links in an e-mail that appeared to be from the “ethics board.”

It’s not just small firms and state agencies that are at risk.

DLA Piper is one of the largest firms in the U.S. and has offices all over the world. Last June, DLA Piper issued this cybersecurity advice in response to a global ransomware attack. Unfortunately, and as reported by Above The Law, DLA Piper fell victim to a similar attack shortly after issuing the warning.

Remember: the Rules of Professional Conduct impose a duty to act competently to safeguard client information. I understand that some of you worry that your unfamiliarity with technology will make you look silly if you ask for help. Stop worrying. Doing nothing other than hoping that it doesn’t happen to you is not a reasonable alternative.

So, earlier today, I warned of a phishing scam that I believed to be targeting lawyers.

Here’s how the afternoon went.

An attorney contacted the Professional Responsibility Program. The attorney informed my assistant of receiving an email from the “ethics board” that informed the attorney that a complaint had been filed. The attorney indicated that the e-mail invited the attorney to click on a link to review the complaint and another to file a response.

My assistant asked the attorney to forward the e-mail. Then, my assistant informed me that there might be a phishing scam targeting lawyers and that she’d forward the e-mail as soon as she received it from the attorney who contacted her. Minutes later, she received the e-mail and forwarded it to me.

It was obvious that the e-mail was not from Bar Counsel, Disciplinary Counsel, or anyone associated with the Professional Responsibility Program. So, I immediately posted to my blog, warning about the scam. I also posted the warning on Twitter and Instagram.

Next, I sent out a warning via e-mail to a very large distribution list. In it, I warned about the scam. Finally, I notifed lawyers in the Secretary of State’s Office of Professional Regulation, for their own benefit and in case the scammers were also targeting other licensed professionals. As I was typing the e-mail, Disciplinary Counsel Sarah Katz left me a voice mail. In her message, she said that an attorney had contacted her to ask about an e-mail that purported to notify the attorney that a complaint had been filed with the “ethics board.” Sarah and the attorney were concerned that the e-mail was fake and a phishing scam. The attorney who contacted Sarah was not the same attorney who contacted my assistant.

In short, within minutes of each other, two different attorneys contacted the Professional Responsibility Program to register concern about what appeared to be a phishing scam targeting lawyers.

Turns out, the two lawyers work at the same place. I’ve since heard from another lawyer who works there, as well as someone from their IT. Here’s what the IT person wrote: “Mike, please call me on my cell (xxx-xxxx) or at work at (xxx-xxxx) so that we can talk about the email scam which was a phishing test originated by me.”

That’s right. False alarm.

Interesting.

Especially since today’s “phishing test” was almost identical to an actual scam that targeted lawyers last summer, prompted warnings from the state bars of Nevada, California, and Florida, and resulted in this blog post from me.

I apologize for any inconvenience that I caused.

To be clear, I did not have prior notice. The office where it happened isn’t exactly small. I wonder if schools let the fire department know before they conduct fire drills.

In any event, it’s a learning opportunity. As I mentioned last year and again today, the scam is not uncommon. The Professional Responsibility Program will never ask a lawyer to click on a link to open or respond to a disciplinary complaint.

The 1st Amendment to the United States Constitution lists 6 things about which “Congress shall make no law.” 1 point for each you can name.

establishing religion

prohibiting the free exercise of religion

abridging the freedom of speech

abridging the freedom of the press

abridging the right of the people peaceably to assemble

abridging the right of the people to petition the government for redress of grievances

Question 2

On May 1, 2017, the ABA marked “Law Day” by celebrating an amendment that it called “a mini-constitution for modern times.” The amendment is the longest, and per the ABA, “arguably the most important.” Name the amendment.

The 14th Amendment.

Question 3

Which is different from the others?

A. right to be secure from unreasonable searches & seizures

B. right not to be compelled to self-incriminate in a criminal matter

C. right not to be deprived of life, liberty, or property without due process of law

D. right not to have private property taken for public use without just compensation

Answer “A” is the answer I had in mind when I crafted the question. The right to be secure from unreasonable searches and seizures is in the 4th Amendment, while the others are in the 5th. However, some readers pointed out that “C” is also different from the others in that it appears in two amendments: the 5th and the 14th. So, credit for “C” as well.

Question 4

The “Great Compromise” reached at the Constitutional Convention likely saved the Constitution and, by extension, the fledging Union.

What are the two things that the “Great Compromise” called for?

proportional representation in the House

equal representation in the Senate

Question 5

In 1792, a boy was born in Danville, Vermont. Later, he attended Burlington College at UVM, but transferred to Dartmouth after the federal government took over UVM during The War of 1812. After graduating from Dartmouth, he became a lawyer and was admitted to the Pennsylvania Bar. For many years, he had very successful practice in Gettysburg.

This Vermont-born lawyer eventually was elected to the United States Congress as a “radical republican” from Pennsylvania. During the Civil War, he served as the chair of the House Ways & Means Committee. His work as chair was key to the Union’s efforts to fund the war.

A staunch abolitionist, this Vermont-born lawyer played a critical role in the passage of the 13th and 14th Amendments to the United States Constitution. In response to the House vote to authorize the 13th Amendment, he said:

“I will be satisfied if my epitaph shall be written thus, ‘Here lies one who never rose to any eminence, and who only courted the low ambition to have it said that he had striven to ameliorate the condition of the poor, the lowly, the downtrodden of every race and language and color.’ ”

In 2013, Tommy Lee Jones received an Oscar nomination for Best Supporting Actor for his portrayal of this Vermont-born lawyer in the movie Lincoln.

There are many more advisory opinions & court decisions on the topic. Today, I’m focusing on these three.

A few takeaways:

The opinions from D.C. and NH make it clear that a lawyer’s duty of competence includes a duty to be aware of the benefits and risks of social media. Referring to Rule 1.1 and the duty of competence, the D.C. Opinion notes that: “[b]ecause of society’s embrace of technology, a lawyer’s ignorance or disregard of it, including social media, presents a risk of ethical misconduct.”

In addition, Rule 1.3 imposes a duty to provide a client with diligent representation. Here again, the D.C. and NH opinions indicate that a lawyer’s duties to provide competent and diligent representation include a duty to understand that an adversary or witness may have made information publicly available on a social media platform. Or, as the NH Bar stated in referring to Rules 1.1 and 1.3, “[i]n light of these obligations, counsel has a general duty to be aware of social media as a source of potentially useful information in litigation, to be competent to obtain that information directly or through an agent, and to know how to make effective use of that information in litigation.”

But what about information that is not publicly available? Can a lawyer send a “friend” request to an adversary or witness? Can a lawyer “follow” or “connect” with an adversary or witness? The opinions advise to proceed with caution.

A “friend” request is a communication. So, if the adversary or witness is represented, a “friend” request sent directly to the person might violate Rule 4.2, aka “the no-contact rule.”

Further, don’t forget your duties of honesty, candor, and fair dealing. Are you really the adversary’s or witness’s “friend?” The Massachusetts and New Hampshire opinions conclude that a Facebook “friend request,” a request to follow a private Twitter account, and a request to “connect” on LinkedIn must include a communication that identifies the lawyer and the lawyer’s role in the matter about which the lawyer is seeking information. The failure to do so constitutes misrepresentation by omission. As the MassBar’s Opinion states:

“We do not agree with the conclusion of the Oregon Ethics Committee in its Opinion No. 2013-189 that the burden should be on the unrepresented party to ask about the inquirer’s purpose rather than on the lawyer to disclose her identity and/or purpose. We believe that it is permissible to ‘friend’ [an opposing party] in this situation in order to access nonpublic information only when the lawyer has been able to send a message that discloses her identity as [an adversary’s] lawyer. Facebook, LinkedIn and other social media sites allow the invitation to include a message. We also do not agree with the suggestion in Formal Opinion 2010-2 of the New York City Bar Association’s Committee that the lawyer’s identification message may be contained in a ‘profile’ created on the lawyer’s personal social media page. It is well known that ‘friending’ requests are often granted quite casually, and viewing the invitee’s profile is not necessarily a mandatory step in accepting a ‘friend’ request. The lawyer’s message must accompany the ‘friending’ request in order to avoid the very real possibility that the recipient will be deceived. Although this communication medium is obviously different, the bottom line resembles a telephone call in which the lawyer does not adequately identify herself.”

Today, I wanted to be succinct, even more succinct than this post turned out. So, I’m going to stop here. I’ll leave you with this: I view the rules as requiring a lawyer to know (1) that an adversary or opposing witness likely has posted to a social media platform information that could be helpful to the lawyer’s client; and, (2) that a client likely has posted to a social media platform information that could be helpful to an advesary.

For more, I suggest that you read each of the 3 advisory opinions. Each goes into more detail, and each includes discussion of issues that I did not present in this post.